Hacktron AI researchers breached OpenAI using Anthropic's Claude tool

The incident demonstrates that AI-assisted vulnerability exploitation can compress attack development from months to days, directly affecting security timelines for companies using standard software dependencies. OpenAI's incident highlights systemic risks: the underlying libheif flaw was already patched upstream in May 2026 but remained untracked as a formal CVE and unpatched in third-party distributions, exposing Discourse installations used by Slack, Meta, and others. The 14-hour patch window and $6,500 bounty reflect immediate remediation, but the broader supply-chain gap—unpatched libraries in production systems—remains unresolved across multiple companies.